Integer overflow in the jpeg_data_load_data function in jpeg-data.c in libjpeg in exif 0.6.20 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain potentially sensitive information via a crafted JPEG file.

The remote Solaris system is missing necessary patches to address security updates :

  - The exif_entry_get_value function in exif-entry.c in the     EXIF Tag Parsing Library (aka libexif) before 0.6.21     allows remote attackers to cause a denial of service     (out-of-bounds read) or possibly obtain sensitive     information from process memory via crafted EXIF tags in     an image. (CVE-2012-2812)

  - The exif_convert_utf16_to_utf8 function in exif-entry.c     in the EXIF Tag Parsing Library (aka libexif) before     0.6.21 allows remote attackers to cause a denial of     service (out-of-bounds read) or possibly obtain     sensitive information from process memory via crafted     EXIF tags in an image. (CVE-2012-2813)

  - Buffer overflow in the exif_entry_format_value function     in exif-entry.c in the EXIF Tag Parsing Library (aka     libexif) 0.6.20 allows remote attackers to cause a     denial of service or possibly execute arbitrary code via     crafted EXIF tags in an image. (CVE-2012-2814)

  - The exif_data_load_data function in exif-data.c in the     EXIF Tag Parsing Library (aka libexif) before 0.6.21     allows remote attackers to cause a denial of service     (out-of-bounds read) or possibly obtain sensitive     information from process memory via crafted EXIF tags in     an image. (CVE-2012-2836)

  - The mnote_olympus_entry_get_value function in     olympus/mnote-olympus-entry.c in the EXIF Tag Parsing     Library (aka libexif) before 0.6.21 allows remote     attackers to cause a denial of service (divide-by-zero     error) via an image with crafted EXIF tags that are not     properly handled during the formatting of EXIF maker     note tags. (CVE-2012-2837)

  - Off-by-one error in the exif_convert_utf16_to_utf8     function in exif-entry.c in the EXIF Tag Parsing Library     (aka libexif) before 0.6.21 allows remote attackers to     cause a denial of service or possibly execute arbitrary     code via crafted EXIF tags in an image. (CVE-2012-2840)

  - Integer underflow in the exif_entry_get_value function     in exif-entry.c in the EXIF Tag Parsing Library (aka     libexif) 0.6.20 might allow remote attackers to execute     arbitrary code via vectors involving a crafted     buffer-size parameter during the formatting of an EXIF     tag, leading to a heap-based buffer overflow.
    (CVE-2012-2841)

  - Integer overflow in the jpeg_data_load_data function in     jpeg-data.c in libjpeg in exif 0.6.20 allows remote     attackers to cause a denial of service (buffer over-read     and application crash) or obtain potentially sensitive     information via a crafted JPEG file. (CVE-2012-2845)

The remote host is affected by the vulnerability described in GLSA-201401-10 (libexif, exif: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libexif and exif.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted image       file using exif or an application linked against libexif, possibly       resulting in execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

A vulnerability has been discovered and corrected in exif :

An integer overflow in the function jpeg_data_load_data in the exif program could cause a data read beyond the end of a buffer, causing an application crash or leakage of potentially sensitive information when parsing a crafted JPEG file (CVE-2012-2845).

The updated packages have been upgraded to the 0.6.21 version which is not vulnerable to this issue.

libexif project security advisory :

A number of remotely exploitable issues were discovered in libexif and exif, with effects ranging from information leakage to potential remote code execution.

- Update to 0.6.21

    - Fix CVE-2012-2845 (RHBZ #840002,#840003)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New libexif packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix security issues.

ID	Name	Product	Family	Severity
80668	Oracle Solaris Third-Party Patch Update : libexif (multiple_vulnerabilities_in_libexif1)	Nessus	Solaris Local Security Checks	high
72032	GLSA-201401-10 : libexif, exif: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
66050	Mandriva Linux Security Advisory : exif (MDVSA-2013:036)	Nessus	Mandriva Local Security Checks	medium
65560	FreeBSD : libexif -- multiple remote vulnerabilities (d881d254-70c6-11e2-862d-080027a5ec9a)	Nessus	FreeBSD Local Security Checks	high
61960	Mandriva Linux Security Advisory : exif (MDVSA-2012:107)	Nessus	Mandriva Local Security Checks	medium
60132	Fedora 17 : exif-0.6.21-1.fc17 (2012-10854)	Nessus	Fedora Local Security Checks	medium
60130	Fedora 16 : exif-0.6.21-1.fc16 (2012-10819)	Nessus	Fedora Local Security Checks	medium
60050	Slackware 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / current : libexif (SSA:2012-200-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2012-2845

medium

Tenable Plugins

high

high

medium

high

medium

medium

medium

high